Examkin

Question

Difficulty: Very hardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network engineer is analyzing connectivity failures on a Cisco Catalyst switch serving VLAN 20. DHCP Snooping and Dynamic ARP Inspection (DAI) are globally enabled and configured on VLAN 20. Users connected to access ports report that they fail to receive DHCP IP addresses, valid ARP requests from hosts are dropped by the switch engine, and port-security sticky MAC addresses learned on access port GigabitEthernet0/2 were lost following a switch reboot.

Which TWO administrative actions are required to resolve the DHCP/DAI packet drops and permanently persist the learned sticky MAC addresses across switch reboots? (Select TWO.)

  1. Configure `ip dhcp snooping trust` and `ip arp inspection trust` on trunk interface GigabitEthernet0/1 connected to the DHCP server and default gateway.Answer
  2. B
    Execute `switchport port-security mac-address sticky` again on GigabitEthernet0/2 to force automatic writing to the startup-config NVRAM.
  3. Execute `copy running-config startup-config` after sticky MAC addresses have been dynamically learned into the running configuration.Answer
  4. D
    Configure VLAN 20 as the native VLAN on trunk interface GigabitEthernet0/1 to bypass DHCP Snooping and DAI validation engines.

Answer

The administrator must trust the uplink trunk port for both DHCP Snooping and Dynamic ARP Inspection, and save the running configuration to the startup configuration so dynamically learned sticky MAC addresses persist across reboots.
Configuring trust settings (`ip dhcp snooping trust` and `ip arp inspection trust`) on the uplink interface allows authorized DHCP responses and ARP packets from the default gateway to pass without being dropped. Additionally, executing `copy running-config startup-config` saves the dynamically learned sticky MAC addresses from RAM into NVRAM, ensuring they persist after a switch reload.

Step-by-Step Solution

1
Identify the cause of DHCP and ARP drops on the uplink trunk interface.
By default, all switch ports are untrusted when DHCP Snooping and DAI are enabled. Untrusted ports block incoming DHCP server responses (OFFER/ACK) and inspect all ARP packets against the DHCP snooping binding database. Because the gateway router ARP responses and DHCP offer packets arrive on untrusted uplink GigabitEthernet0/1, the switch drops them.
Uplink ports connected to authorized infrastructure (DHCP server, default gateway router) must be designated as trusted using `ip dhcp snooping trust` and `ip arp inspection trust`.
2
Determine why sticky MAC addresses were lost on GigabitEthernet0/2 after a reload.
Port security sticky MAC addresses are dynamically learned and written directly to the active `running-config` in volatile RAM. They are not automatically copied to NVRAM startup memory.
Executing `copy running-config startup-config` (or `write memory`) is mandatory after sticky MAC addresses are learned to preserve them in NVRAM across device reboots.

Key Concept

Layer 2 Security Trust Boundaries and Configuration Persistence
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic